[Lab] Test after ENG-694 migration #143
Conversation
![Amplify [Lab]](https://avatars.githubusercontent.com/in/347747?s=40&u=f167c38980969fad1d181fdacb66403b97c6399a&v=4){kind=avatar}
✨ Amplify has finished checking this pull requestSecurity Pipeline
Vulnerabilities Detected
Note To ignore a finding, append |
![amplify-lab[bot]](https://avatars.githubusercontent.com/in/347747?s=60&v=4){kind=small}
|
|
||
| // vuln-code-snippet start unionSqlInjectionChallenge dbSchemaChallenge | ||
| module.exports = function searchProducts() { | ||
| return (req: Request, res: Response, next: NextFunction) => { | ||
| let criteria: any = req.query.q === 'undefined' ? '' : req.query.q ?? '' | ||
| criteria = (criteria.length <= 200) ? criteria : criteria.substring(0, 200) | ||
| console.log(criteria) | ||
| models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`) |
There was a problem hiding this comment.
Warning
Amplify has been notified that this line contains a vulnerability 🕷️.
Vulnerability: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Impact: MEDIUM
Code Fix: ✅
Amplify Security has prepared an automated remediation for review. Click here to review and commit the code fix.
| models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`) | |
| models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE :criteria OR description LIKE :criteria) AND deletedAt IS NULL) ORDER BY name`, { replacements: { criteria: `%${criteria}%` } }) |
The code change fixes the 'Cross-site Scripting' vulnerability by using parameterized queries instead of directly concatenating user input into the SQL query string.
In the original code, the user input criteria is directly concatenated into the SQL query string using string interpolation. This can lead to a vulnerability known as Cross-site Scripting (XSS) because an attacker can inject malicious code into the criteria parameter, which will then be executed as part of the SQL query.
The code change replaces the string interpolation with a parameterized query. In a parameterized query, placeholders are used in the SQL query string, and the actual values are passed separately as parameters. This ensures that the user input is treated as data and not as part of the query structure, preventing any malicious code injection.
Here's the updated code:
models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE :criteria OR description LIKE :criteria) AND deletedAt IS NULL) ORDER BY name`, { replacements: { criteria: `%${criteria}%` } })In this code, the :criteria placeholder is used in the SQL query string, and the actual value of criteria is passed as a parameter using the replacements option. This ensures that the user input is properly sanitized and prevents any potential XSS attacks.
For more information on preventing XSS vulnerabilities, you can refer to the OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
Note
Have a question or concern about this vulnerability fix? Get an answer within seconds by asking our Concierge 🤖 with @amplify-security.
i.e. @amplify-security are there known performance issues resulting from this fix?
| models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`) | ||
| .then(([products]: any) => { |
There was a problem hiding this comment.
Warning
Amplify has been notified that this line contains a vulnerability 🕷️.
Vulnerability: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Impact: HIGH
Code Fix: ✅
Amplify Security has prepared an automated remediation for review. Click here to review and commit the code fix.
| models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`) | |
| .then(([products]: any) => { | |
| models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE :criteria OR description LIKE :criteria) AND deletedAt IS NULL) ORDER BY name`, { replacements: { criteria: `%${criteria}%` }, type: models.sequelize.QueryTypes.SELECT }) | |
| .then((products: any) => { |
The code change fixes the SQL Injection vulnerability by using parameterized queries instead of directly concatenating user input into the SQL query string.
In the original code, the user input criteria is directly concatenated into the SQL query string using string interpolation (%${criteria}%). This allows an attacker to manipulate the criteria value and inject malicious SQL code, potentially leading to unauthorized access or data manipulation.
In the fixed code, the criteria value is passed as a parameter using the replacements option in the sequelize.query method. The :criteria placeholder is used in the SQL query string, and the actual value is provided in the replacements object ({ replacements: { criteria: %${criteria}% } }). This ensures that the user input is properly sanitized and treated as a parameter, preventing SQL injection attacks.
For more information on preventing SQL injection vulnerabilities, you can refer to the following documentation:
Note
Have a question or concern about this vulnerability fix? Get an answer within seconds by asking our Concierge 🤖 with @amplify-security.
i.e. @amplify-security are there known performance issues resulting from this fix?
Description
A clear and concise summary of the change and which issue (if any) it fixes. Should also include relevant motivation and context.
Resolved or fixed issue:
Affirmation